Penetration Testing

Spec & Goals 3 min

AQA Spec 3.6.1.1 — What penetration testing is and what it is used for

By the end of this lesson you can:

1. Define penetration testing.
2. Explain what penetration testing is used for.
3. Describe the difference between white-box and black-box testing.

Warm-Up 5 min

You've met many threats. How does an organisation find its own weaknesses before a real attacker does? It hires someone to attack it on purpose — safely.

Quick starter

A locksmith is paid to try to break into a shop to check its locks. Why is this safer than waiting for a burglar?

Key Concept — attacking yourself, safely 14 min

Penetration testing ("pen testing") is the practice of deliberately attacking your own system — with permission — to find security weaknesses before a real attacker exploits them.

What it is used for

• Find vulnerabilities — weak passwords, unpatched software, misconfigured access rights, injectable inputs.
• Test defences — do the firewall, anti-malware and access controls actually hold?
• Prioritise fixes — a report tells the organisation what to repair first.
• Reassure — meet security standards and customer expectations.

White-box vs black-box testing

Worked Example — planning a pen test 12 min

Problem: A KL online retailer hires a tester. Explain what the test should look for and which approach simulates which attacker.

• What to probe: the login (brute force, SQL injection), the network (open ports, firewall gaps), the software (unpatched versions), and staff (phishing susceptibility).
• Black-box first: the tester starts with no access, like a real outside hacker — does the site give anything away?
• White-box next: given logins and code, the tester checks for insider risks and deeper flaws.
• Output: a report ranking each weakness so the retailer fixes the most dangerous first.

Try It Yourself 12 min

📝 Exam Practice 10 min

Recap & Key Terms 3 min

Penetration testing is authorised, simulated attack used to find weaknesses before real attackers do, then fix them. White-box testing uses inside knowledge (simulating an insider); black-box uses none (simulating an outside hacker). It must be done with permission.

Penetration testing

Authorised simulated attacks to find and fix security weaknesses before attackers exploit them.

White-box testing

Pen testing with inside knowledge of the system, simulating a malicious insider.

Black-box testing

Pen testing with no inside knowledge, simulating an external attacker.

Vulnerability

A weakness in a system that an attacker could exploit.

Homework 1 min

Task (≤ 15 min): A hospital wants to test its security. Write a short brief explaining what penetration testing is, why it should be done, and why both white-box and black-box tests are useful.